summaryrefslogtreecommitdiffstats
path: root/meta/recipes-devtools/qemu
diff options
context:
space:
mode:
authorTudor Florea <tudor.florea@enea.com>2015-10-09 22:59:03 +0200
committerTudor Florea <tudor.florea@enea.com>2015-10-09 22:59:03 +0200
commit972dcfcdbfe75dcfeb777150c136576cf1a71e99 (patch)
tree97a61cd7e293d7ae9d56ef7ed0f81253365bb026 /meta/recipes-devtools/qemu
downloadpoky-972dcfcdbfe75dcfeb777150c136576cf1a71e99.tar.gz
initial commit for Enea Linux 5.0 arm
Signed-off-by: Tudor Florea <tudor.florea@enea.com>
Diffstat (limited to 'meta/recipes-devtools/qemu')
-rw-r--r--meta/recipes-devtools/qemu/files/0001-Back-porting-security-fix-CVE-2014-5388.patch30
-rw-r--r--meta/recipes-devtools/qemu/files/Qemu-Arm-versatilepb-Add-memory-size-checking.patch40
-rw-r--r--meta/recipes-devtools/qemu/files/exclude-some-arm-EABI-obsolete-syscalls.patch93
-rw-r--r--meta/recipes-devtools/qemu/files/qemu-enlarge-env-entry-size.patch31
-rw-r--r--meta/recipes-devtools/qemu/nativesdk-qemu-helper_1.0.bb47
-rw-r--r--meta/recipes-devtools/qemu/qemu-helper-native_1.0.bb21
-rw-r--r--meta/recipes-devtools/qemu/qemu-helper/raw2flash.c370
-rw-r--r--meta/recipes-devtools/qemu/qemu-helper/tunctl.c156
-rw-r--r--meta/recipes-devtools/qemu/qemu-targets.inc22
-rw-r--r--meta/recipes-devtools/qemu/qemu.inc124
-rw-r--r--meta/recipes-devtools/qemu/qemu/CVE-2014-7840.patch57
-rw-r--r--meta/recipes-devtools/qemu/qemu/configure-fix-Darwin-target-detection.patch32
-rw-r--r--meta/recipes-devtools/qemu/qemu/disable-grabs.patch72
-rw-r--r--meta/recipes-devtools/qemu/qemu/fix-libcap-header-issue-on-some-distro.patch84
-rw-r--r--meta/recipes-devtools/qemu/qemu/larger_default_ram_size.patch22
-rw-r--r--meta/recipes-devtools/qemu/qemu/powerpc_rom.binbin0 -> 4096 bytes
-rw-r--r--meta/recipes-devtools/qemu/qemu/qemu-CVE-2015-3456.patch92
-rw-r--r--meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch48
-rw-r--r--meta/recipes-devtools/qemu/qemu/vnc-CVE-2014-7815.patch53
-rw-r--r--meta/recipes-devtools/qemu/qemu/wacom.patch130
-rw-r--r--meta/recipes-devtools/qemu/qemu_2.1.0.bb32
-rw-r--r--meta/recipes-devtools/qemu/qemu_git.bb15
-rw-r--r--meta/recipes-devtools/qemu/qemuwrapper-cross_1.0.bb48
23 files changed, 1619 insertions, 0 deletions
diff --git a/meta/recipes-devtools/qemu/files/0001-Back-porting-security-fix-CVE-2014-5388.patch b/meta/recipes-devtools/qemu/files/0001-Back-porting-security-fix-CVE-2014-5388.patch
new file mode 100644
index 0000000000..ec541fa668
--- /dev/null
+++ b/meta/recipes-devtools/qemu/files/0001-Back-porting-security-fix-CVE-2014-5388.patch
@@ -0,0 +1,30 @@
1Prevent out-of-bounds array access on
2acpi_pcihp_pci_status.
3
4Upstream-Status: Backport
5
6Signed-off-by: Gonglei <arei.gonglei@huawei.com>
7Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
8---
9v2:
10 - change commit message.
11 - add 'Reviewed-by'
12---
13 hw/acpi/pcihp.c | 2 +-
14 1 file changed, 1 insertion(+), 1 deletion(-)
15
16diff --git a/hw/acpi/pcihp.c b/hw/acpi/pcihp.c
17index fae663a..34dedf1 100644
18--- a/hw/acpi/pcihp.c
19+++ b/hw/acpi/pcihp.c
20@@ -231,7 +231,7 @@ static uint64_t pci_read(void *opaque, hwaddr addr, unsigned int size)
21 uint32_t val = 0;
22 int bsel = s->hotplug_select;
23
24- if (bsel < 0 || bsel > ACPI_PCIHP_MAX_HOTPLUG_BUS) {
25+ if (bsel < 0 || bsel >= ACPI_PCIHP_MAX_HOTPLUG_BUS) {
26 return 0;
27 }
28
29--
301.7.12.4
diff --git a/meta/recipes-devtools/qemu/files/Qemu-Arm-versatilepb-Add-memory-size-checking.patch b/meta/recipes-devtools/qemu/files/Qemu-Arm-versatilepb-Add-memory-size-checking.patch
new file mode 100644
index 0000000000..7f1c5a9058
--- /dev/null
+++ b/meta/recipes-devtools/qemu/files/Qemu-Arm-versatilepb-Add-memory-size-checking.patch
@@ -0,0 +1,40 @@
1From 896fa02c24347e6e9259812cfda187b1d6ca6199 Mon Sep 17 00:00:00 2001
2From: Jiang Lu <lu.jiang@windriver.com>
3Date: Wed, 13 Nov 2013 10:38:08 +0800
4Subject: [PATCH] Qemu:Arm:versatilepb: Add memory size checking
5
6The machine can not work with memory over 256M, so add a checking
7at startup. If the memory size exceed 256M, just stop emulation then
8throw out warning about memory limitation.
9
10Upstream-Status: Pending
11
12Signed-off-by: Jiang Lu <lu.jiang@windriver.com>
13
14Updated it on 2014-01-15 for rebasing
15
16Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
17---
18 hw/arm/versatilepb.c | 6 ++++++
19 1 file changed, 6 insertions(+)
20
21diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
22index b48d84c..ad2cd5a 100644
23--- a/hw/arm/versatilepb.c
24+++ b/hw/arm/versatilepb.c
25@@ -199,6 +199,12 @@ static void versatile_init(QEMUMachineInitArgs *args, int board_id)
26 fprintf(stderr, "Unable to find CPU definition\n");
27 exit(1);
28 }
29+ if (ram_size > (256 << 20)) {
30+ fprintf(stderr,
31+ "qemu: Too much memory for this machine: %d MB, maximum 256 MB\n",
32+ ((unsigned int)ram_size / (1 << 20)));
33+ exit(1);
34+ }
35 memory_region_init_ram(ram, NULL, "versatile.ram", machine->ram_size);
36 vmstate_register_ram_global(ram);
37 /* ??? RAM should repeat to fill physical memory space. */
38--
391.7.10.4
40
diff --git a/meta/recipes-devtools/qemu/files/exclude-some-arm-EABI-obsolete-syscalls.patch b/meta/recipes-devtools/qemu/files/exclude-some-arm-EABI-obsolete-syscalls.patch
new file mode 100644
index 0000000000..171bda7e95
--- /dev/null
+++ b/meta/recipes-devtools/qemu/files/exclude-some-arm-EABI-obsolete-syscalls.patch
@@ -0,0 +1,93 @@
1[PATCH] exclude some arm EABI obsolete syscalls
2
3Upstream-Status: Pending
4
5some syscalls are obsolete and no longer available for EABI, exclude them to
6fix the below error:
7 In file included from qemu-seccomp.c:16:0:
8 qemu-seccomp.c:28:7: error: '__NR_select' undeclared here (not in a function)
9 { SCMP_SYS(select), 252 },
10 ^
11 qemu-seccomp.c:36:7: error: '__NR_mmap' undeclared here (not in a function)
12 { SCMP_SYS(mmap), 247 },
13 ^
14 qemu-seccomp.c:57:7: error: '__NR_getrlimit' undeclared here (not in a function)
15 { SCMP_SYS(getrlimit), 245 },
16 ^
17 qemu-seccomp.c:96:7: error: '__NR_time' undeclared here (not in a function)
18 { SCMP_SYS(time), 245 },
19 ^
20 qemu-seccomp.c:185:7: error: '__NR_alarm' undeclared here (not in a function)
21 { SCMP_SYS(alarm), 241 },
22
23please refer source files:
24 arch/arm/include/uapi/asm/unistd.h
25or kernel header:
26 /usr/include/asm/unistd.h
27
28Signed-off-by: Roy.Li <rongqing.li@windriver.com>
29---
30 qemu-seccomp.c | 14 ++++++++------
31 1 file changed, 8 insertions(+), 6 deletions(-)
32
33diff --git a/qemu-seccomp.c b/qemu-seccomp.c
34index caa926e..5a78502 100644
35--- a/qemu-seccomp.c
36+++ b/qemu-seccomp.c
37@@ -25,15 +25,21 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
38 { SCMP_SYS(timer_settime), 255 },
39 { SCMP_SYS(timer_gettime), 254 },
40 { SCMP_SYS(futex), 253 },
41+#if !defined(__ARM_EABI__)
42 { SCMP_SYS(select), 252 },
43+ { SCMP_SYS(time), 245 },
44+ { SCMP_SYS(alarm), 241 },
45+ { SCMP_SYS(getrlimit), 245 },
46+ { SCMP_SYS(mmap), 247 },
47+ { SCMP_SYS(socketcall), 250 },
48+ { SCMP_SYS(ipc), 245 },
49+#endif
50 { SCMP_SYS(recvfrom), 251 },
51 { SCMP_SYS(sendto), 250 },
52- { SCMP_SYS(socketcall), 250 },
53 { SCMP_SYS(read), 249 },
54 { SCMP_SYS(io_submit), 249 },
55 { SCMP_SYS(brk), 248 },
56 { SCMP_SYS(clone), 247 },
57- { SCMP_SYS(mmap), 247 },
58 { SCMP_SYS(mprotect), 246 },
59 { SCMP_SYS(execve), 245 },
60 { SCMP_SYS(open), 245 },
61@@ -48,13 +54,11 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
62 { SCMP_SYS(bind), 245 },
63 { SCMP_SYS(listen), 245 },
64 { SCMP_SYS(semget), 245 },
65- { SCMP_SYS(ipc), 245 },
66 { SCMP_SYS(gettimeofday), 245 },
67 { SCMP_SYS(readlink), 245 },
68 { SCMP_SYS(access), 245 },
69 { SCMP_SYS(prctl), 245 },
70 { SCMP_SYS(signalfd), 245 },
71- { SCMP_SYS(getrlimit), 245 },
72 { SCMP_SYS(set_tid_address), 245 },
73 { SCMP_SYS(statfs), 245 },
74 { SCMP_SYS(unlink), 245 },
75@@ -93,7 +97,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
76 { SCMP_SYS(times), 245 },
77 { SCMP_SYS(exit), 245 },
78 { SCMP_SYS(clock_gettime), 245 },
79- { SCMP_SYS(time), 245 },
80 { SCMP_SYS(restart_syscall), 245 },
81 { SCMP_SYS(pwrite64), 245 },
82 { SCMP_SYS(nanosleep), 245 },
83@@ -182,7 +185,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
84 { SCMP_SYS(lstat64), 241 },
85 { SCMP_SYS(sendfile64), 241 },
86 { SCMP_SYS(ugetrlimit), 241 },
87- { SCMP_SYS(alarm), 241 },
88 { SCMP_SYS(rt_sigsuspend), 241 },
89 { SCMP_SYS(rt_sigqueueinfo), 241 },
90 { SCMP_SYS(rt_tgsigqueueinfo), 241 },
91--
921.9.1
93
diff --git a/meta/recipes-devtools/qemu/files/qemu-enlarge-env-entry-size.patch b/meta/recipes-devtools/qemu/files/qemu-enlarge-env-entry-size.patch
new file mode 100644
index 0000000000..c7425ab8d4
--- /dev/null
+++ b/meta/recipes-devtools/qemu/files/qemu-enlarge-env-entry-size.patch
@@ -0,0 +1,31 @@
1qemu: Add addition environment space to boot loader qemu-system-mips
2
3Upstream-Status: Inappropriate - OE uses deep paths
4
5If you create a project with very long directory names like 128 characters
6deep and use NFS, the kernel arguments will be truncated. The kernel will
7accept longer strings such as 1024 bytes, but the qemu boot loader defaulted
8to only 256 bytes. This patch expands the limit.
9
10Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
11Signed-off-by: Roy Li <rongqing.li@windriver.com>
12---
13 hw/mips/mips_malta.c | 2 +-
14 1 files changed, 1 insertions(+), 1 deletions(-)
15
16diff --git a/hw/mips/mips_malta.c b/hw/mips/mips_malta.c
17index 9d521cc..17c0391 100644
18--- a/hw/mips/mips_malta.c
19+++ b/hw/mips/mips_malta.c
20@@ -53,7 +53,7 @@
21
22 #define ENVP_ADDR 0x80002000l
23 #define ENVP_NB_ENTRIES 16
24-#define ENVP_ENTRY_SIZE 256
25+#define ENVP_ENTRY_SIZE 1024
26
27 /* Hardware addresses */
28 #define FLASH_ADDRESS 0x1e000000ULL
29--
301.7.10.4
31
diff --git a/meta/recipes-devtools/qemu/nativesdk-qemu-helper_1.0.bb b/meta/recipes-devtools/qemu/nativesdk-qemu-helper_1.0.bb
new file mode 100644
index 0000000000..51d1c59699
--- /dev/null
+++ b/meta/recipes-devtools/qemu/nativesdk-qemu-helper_1.0.bb
@@ -0,0 +1,47 @@
1SUMMARY = "Qemu helper scripts"
2LICENSE = "GPLv2"
3RDEPENDS_${PN} = "nativesdk-qemu"
4PR = "r9"
5
6
7LIC_FILES_CHKSUM = "file://${WORKDIR}/tunctl.c;endline=4;md5=ff3a09996bc5fff6bc5d4e0b4c28f999 \
8 file://${COREBASE}/scripts/runqemu;endline=18;md5=77fbe442a88b1bcdc29c3ba67733b21b"
9
10
11SRC_URI = "file://${COREBASE}/scripts/runqemu \
12 file://${COREBASE}/scripts/runqemu-internal \
13 file://${COREBASE}/scripts/runqemu-addptable2image \
14 file://${COREBASE}/scripts/runqemu-gen-tapdevs \
15 file://${COREBASE}/scripts/runqemu-ifup \
16 file://${COREBASE}/scripts/runqemu-ifdown \
17 file://${COREBASE}/scripts/oe-find-native-sysroot \
18 file://${COREBASE}/scripts/runqemu-extract-sdk \
19 file://${COREBASE}/scripts/runqemu-export-rootfs \
20 file://tunctl.c \
21 file://raw2flash.c \
22 "
23
24S = "${WORKDIR}"
25
26inherit nativesdk
27
28do_compile() {
29 ${CC} tunctl.c -o tunctl
30 ${CC} raw2flash.c -o raw2flash.spitz
31 ${CC} raw2flash.c -o flash2raw.spitz -Dflash2raw
32}
33
34do_install() {
35 install -d ${D}${bindir}
36 install -m 0755 ${WORKDIR}${COREBASE}/scripts/oe-* ${D}${bindir}/
37 install -m 0755 ${WORKDIR}${COREBASE}/scripts/runqemu* ${D}${bindir}/
38 install tunctl ${D}${bindir}/
39 install raw2flash.spitz ${D}${bindir}/
40 install flash2raw.spitz ${D}${bindir}/
41 ln -fs raw2flash.spitz ${D}${bindir}/raw2flash.akita
42 ln -fs raw2flash.spitz ${D}${bindir}/raw2flash.borzoi
43 ln -fs raw2flash.spitz ${D}${bindir}/raw2flash.terrier
44 ln -fs flash2raw.spitz ${D}${bindir}/flash2raw.akita
45 ln -fs flash2raw.spitz ${D}${bindir}/flash2raw.borzoi
46 ln -fs flash2raw.spitz ${D}${bindir}/flash2raw.terrier
47}
diff --git a/meta/recipes-devtools/qemu/qemu-helper-native_1.0.bb b/meta/recipes-devtools/qemu/qemu-helper-native_1.0.bb
new file mode 100644
index 0000000000..8d27c4db61
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu-helper-native_1.0.bb
@@ -0,0 +1,21 @@
1SUMMARY = "Helper utilities needed by the runqemu script"
2LICENSE = "GPLv2"
3RDEPENDS_${PN} = "qemu-native"
4PR = "r1"
5
6LIC_FILES_CHKSUM = "file://${WORKDIR}/tunctl.c;endline=4;md5=ff3a09996bc5fff6bc5d4e0b4c28f999"
7
8SRC_URI = "file://tunctl.c"
9
10S = "${WORKDIR}"
11
12inherit native
13
14do_compile() {
15 ${CC} tunctl.c -o tunctl
16}
17
18do_install() {
19 install -d ${D}${bindir}
20 install tunctl ${D}${bindir}/
21}
diff --git a/meta/recipes-devtools/qemu/qemu-helper/raw2flash.c b/meta/recipes-devtools/qemu/qemu-helper/raw2flash.c
new file mode 100644
index 0000000000..19faf629b9
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu-helper/raw2flash.c
@@ -0,0 +1,370 @@
1/*
2 * Copyright (c) 2006 OpenedHand Ltd.
3 *
4 * This file is licensed under GNU GPL v2.
5 */
6#include <string.h>
7#include <unistd.h>
8#include <stdint.h>
9#include <stdio.h>
10#include <sys/types.h>
11#include <stdlib.h>
12
13#define TFR(_) _
14#define VERBOSE
15#define PBAR_LEN 40
16
17#define PARTITION_START 0x00700000
18
19static const int ecc_pos8[] = {
20 0x0, 0x1, 0x2,
21};
22
23static const int ecc_pos16[] = {
24 0x0, 0x1, 0x2, 0x3, 0x6, 0x7,
25};
26
27static const int ecc_pos64[] = {
28 0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
29 0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
30 0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
31};
32
33static const int ecc_akita[] = {
34 0x05, 0x01, 0x02, 0x03, 0x06, 0x07, 0x15, 0x11,
35 0x12, 0x13, 0x16, 0x17, 0x25, 0x21, 0x22, 0x23,
36 0x26, 0x27, 0x35, 0x31, 0x32, 0x33, 0x36, 0x37,
37};
38
39struct jffs_marker_s {
40 int pos;
41 uint8_t value;
42};
43
44static const struct jffs_marker_s free_pos8[] = {
45 { 0x03, 0xff }, { 0x04, 0xff }, { 0x06, 0x85 }, { 0x07, 0x19 },
46 { -1 },
47};
48
49static const struct jffs_marker_s free_pos16[] = {
50 { 0x08, 0x85 }, { 0x09, 0x19 }, { 0x0a, 0x03 }, { 0x0b, 0x20 },
51 { 0x0c, 0x08 }, { 0x0d, 0x00 }, { 0x0e, 0x00 }, { 0x0f, 0x00 },
52 { -1 },
53};
54
55static const struct jffs_marker_s free_pos64[] = {
56 { 0x02, 0xff }, { 0x03, 0xff }, { 0x04, 0xff }, { 0x05, 0xff },
57 { 0x06, 0xff }, { 0x07, 0xff }, { 0x08, 0xff }, { 0x09, 0xff },
58 { 0x0a, 0xff }, { 0x0b, 0xff }, { 0x0c, 0xff }, { 0x0d, 0xff },
59 { 0x0e, 0xff }, { 0x0f, 0xff }, { 0x10, 0x85 }, { 0x11, 0x19 },
60 { 0x12, 0x03 }, { 0x13, 0x20 }, { 0x14, 0x08 }, { 0x15, 0x00 },
61 { 0x16, 0x00 }, { 0x17, 0x00 }, { 0x18, 0xff }, { 0x19, 0xff },
62 { 0x1a, 0xff }, { 0x1b, 0xff }, { 0x1c, 0xff }, { 0x1d, 0xff },
63 { 0x1e, 0xff }, { 0x1f, 0xff }, { 0x20, 0xff }, { 0x21, 0xff },
64 { 0x22, 0xff }, { 0x23, 0xff }, { 0x24, 0xff }, { 0x25, 0xff },
65 { 0x26, 0xff }, { 0x27, 0xff },
66 { -1 },
67};
68
69static const struct jffs_marker_s free_akita[] = {
70 { 0x08, 0x85 }, { 0x09, 0x19 }, { 0x0a, 0x03 }, { 0x0b, 0x20 },
71 { 0x0c, 0x08 }, { 0x0d, 0x00 }, { 0x0e, 0x00 }, { 0x0f, 0x00 },
72 { 0x10, 0xff },
73 { -1 },
74};
75
76#define LEN(array) (sizeof(array) / sizeof(*array))
77
78static const struct ecc_style_s {
79 int page_size;
80 int oob_size;
81 int eccbytes;
82 int eccsize;
83 const int *eccpos;
84 int romsize;
85 const struct jffs_marker_s *freepos;
86} spitz = {
87 0x200, 0x10, 0x100, LEN(ecc_pos16), ecc_pos16, 0x01000000, free_pos16
88}, akita = {
89 0x800, 0x40, 0x100, LEN(ecc_akita), ecc_akita, 0x08000000, free_akita
90}, borzoi = {
91 0x800, 0x40, 0x100, LEN(ecc_akita), ecc_akita, 0x08000000, free_akita
92}, terrier = {
93 0x800, 0x40, 0x100, LEN(ecc_akita), ecc_akita, 0x08000000, free_akita
94};
95
96struct ecc_state_s {
97 int count;
98 uint8_t cp;
99 uint8_t lp[2];
100 const struct ecc_style_s *style;
101};
102
103#ifndef flash2raw
104/*
105 * Pre-calculated 256-way 1 byte column parity. Table borrowed from Linux.
106 */
107static const uint8_t ecc_precalc_table[] = {
108 0x00, 0x55, 0x56, 0x03, 0x59, 0x0c, 0x0f, 0x5a,
109 0x5a, 0x0f, 0x0c, 0x59, 0x03, 0x56, 0x55, 0x00,
110 0x65, 0x30, 0x33, 0x66, 0x3c, 0x69, 0x6a, 0x3f,
111 0x3f, 0x6a, 0x69, 0x3c, 0x66, 0x33, 0x30, 0x65,
112 0x66, 0x33, 0x30, 0x65, 0x3f, 0x6a, 0x69, 0x3c,
113 0x3c, 0x69, 0x6a, 0x3f, 0x65, 0x30, 0x33, 0x66,
114 0x03, 0x56, 0x55, 0x00, 0x5a, 0x0f, 0x0c, 0x59,
115 0x59, 0x0c, 0x0f, 0x5a, 0x00, 0x55, 0x56, 0x03,
116 0x69, 0x3c, 0x3f, 0x6a, 0x30, 0x65, 0x66, 0x33,
117 0x33, 0x66, 0x65, 0x30, 0x6a, 0x3f, 0x3c, 0x69,
118 0x0c, 0x59, 0x5a, 0x0f, 0x55, 0x00, 0x03, 0x56,
119 0x56, 0x03, 0x00, 0x55, 0x0f, 0x5a, 0x59, 0x0c,
120 0x0f, 0x5a, 0x59, 0x0c, 0x56, 0x03, 0x00, 0x55,
121 0x55, 0x00, 0x03, 0x56, 0x0c, 0x59, 0x5a, 0x0f,
122 0x6a, 0x3f, 0x3c, 0x69, 0x33, 0x66, 0x65, 0x30,
123 0x30, 0x65, 0x66, 0x33, 0x69, 0x3c, 0x3f, 0x6a,
124 0x6a, 0x3f, 0x3c, 0x69, 0x33, 0x66, 0x65, 0x30,
125 0x30, 0x65, 0x66, 0x33, 0x69, 0x3c, 0x3f, 0x6a,
126 0x0f, 0x5a, 0x59, 0x0c, 0x56, 0x03, 0x00, 0x55,
127 0x55, 0x00, 0x03, 0x56, 0x0c, 0x59, 0x5a, 0x0f,
128 0x0c, 0x59, 0x5a, 0x0f, 0x55, 0x00, 0x03, 0x56,
129 0x56, 0x03, 0x00, 0x55, 0x0f, 0x5a, 0x59, 0x0c,
130 0x69, 0x3c, 0x3f, 0x6a, 0x30, 0x65, 0x66, 0x33,
131 0x33, 0x66, 0x65, 0x30, 0x6a, 0x3f, 0x3c, 0x69,
132 0x03, 0x56, 0x55, 0x00, 0x5a, 0x0f, 0x0c, 0x59,
133 0x59, 0x0c, 0x0f, 0x5a, 0x00, 0x55, 0x56, 0x03,
134 0x66, 0x33, 0x30, 0x65, 0x3f, 0x6a, 0x69, 0x3c,
135 0x3c, 0x69, 0x6a, 0x3f, 0x65, 0x30, 0x33, 0x66,
136 0x65, 0x30, 0x33, 0x66, 0x3c, 0x69, 0x6a, 0x3f,
137 0x3f, 0x6a, 0x69, 0x3c, 0x66, 0x33, 0x30, 0x65,
138 0x00, 0x55, 0x56, 0x03, 0x59, 0x0c, 0x0f, 0x5a,
139 0x5a, 0x0f, 0x0c, 0x59, 0x03, 0x56, 0x55, 0x00,
140};
141
142/* Update ECC parity count */
143static inline uint8_t ecc_digest(struct ecc_state_s *s, uint8_t sample) {
144 uint8_t idx = ecc_precalc_table[sample];
145
146 s->cp ^= idx & 0x3f;
147 if (idx & 0x40) {
148 s->lp[0] ^= ~(s->count & 0xff);
149 s->lp[1] ^= s->count & 0xff;
150 }
151 s->count ++;
152
153 return sample;
154}
155
156static void buffer_digest(struct ecc_state_s *ecc,
157 const uint8_t *buf, uint8_t *out) {
158 int i, lp_a[2];
159
160 ecc->lp[0] = 0x00;
161 ecc->lp[1] = 0x00;
162 ecc->cp = 0x00;
163 ecc->count = 0;
164 for (i = 0; i < ecc->style->eccbytes; i ++)
165 ecc_digest(ecc, buf[i]);
166
167# define BSHR(byte, from, to) ((ecc->lp[byte] >> (from - to)) & (1 << to))
168 lp_a[0] =
169 BSHR(0, 4, 0) | BSHR(0, 5, 2) |
170 BSHR(0, 6, 4) | BSHR(0, 7, 6) |
171 BSHR(1, 4, 1) | BSHR(1, 5, 3) |
172 BSHR(1, 6, 5) | BSHR(1, 7, 7);
173
174# define BSHL(byte, from, to) ((ecc->lp[byte] << (to - from)) & (1 << to))
175 lp_a[1] =
176 BSHL(0, 0, 0) | BSHL(0, 1, 2) |
177 BSHL(0, 2, 4) | BSHL(0, 3, 6) |
178 BSHL(1, 0, 1) | BSHL(1, 1, 3) |
179 BSHL(1, 2, 5) | BSHL(1, 3, 7);
180
181 out[0] = ~lp_a[1];
182 out[1] = ~lp_a[0];
183 out[2] = (~ecc->cp << 2) | 0x03;
184}
185
186static void jffs2_format(const struct ecc_state_s *ecc, uint8_t oob[]) {
187 const struct jffs_marker_s *byte;
188 for (byte = ecc->style->freepos; byte->pos >= 0; byte ++)
189 oob[byte->pos] = byte->value;
190}
191
192static void buffer_fill(const struct ecc_state_s *ecc, uint8_t buffer[],
193 int *len, int *partition, int count, uint8_t jffs_buffer[]) {
194 int ret;
195
196 switch (*partition) {
197 case 0:
198 if (count < PARTITION_START) {
199 memcpy(buffer, jffs_buffer + count,
200 ecc->style->eccbytes);
201 *len = ecc->style->eccbytes;
202 break;
203 }
204 *partition = 1;
205 case 1:
206 if (count - PARTITION_START < PARTITION_START) {
207 memcpy(buffer, jffs_buffer + count - PARTITION_START,
208 ecc->style->eccbytes);
209 *len = ecc->style->eccbytes;
210 break;
211 }
212
213 while (*len < ecc->style->eccbytes) {
214 ret = TFR(read(0, buffer + *len, 0x800 - *len));
215 if (ret <= 0)
216 break;
217 *len += ret;
218 }
219
220 if (*len == 0)
221 *partition = 2;
222 else if (*len < ecc->style->eccbytes) {
223 fprintf(stderr, "\nWarning: %i stray bytes\n", *len);
224 memset(buffer + *len, 0xff,
225 ecc->style->eccbytes - *len);
226 *len = ecc->style->eccbytes;
227 break;
228 } else
229 break;
230 case 2:
231 memset(buffer, 0xff, ecc->style->eccbytes);
232 *len = ecc->style->eccbytes;
233 break;
234 }
235}
236
237int main(int argc, char *argv[], char *envp[]) {
238 struct ecc_state_s ecc;
239 uint8_t buffer[0x1000], ecc_payload[0x40], regs[3], *jffs;
240 int ret, len, eccbyte, count, partition;
241
242 /* Check if we're called by "raw2flash.spitz" or similar */
243 len = strlen(argv[0]);
244 if (!strcasecmp(argv[0] + len - 5, "akita"))
245 ecc.style = &akita;
246 else if (!strcasecmp(argv[0] + len - 6, "borzoi"))
247 ecc.style = &borzoi;
248 else if (!strcasecmp(argv[0] + len - 7, "terrier"))
249 ecc.style = &terrier;
250 else
251 ecc.style = &spitz;
252
253# ifdef VERBOSE
254 fprintf(stderr, "[");
255# endif
256
257 /* Skip first 10 bytes */
258 TFR(read(0, buffer, 0x10));
259
260 len = 0;
261 jffs = (uint8_t *) malloc(PARTITION_START);
262 while (len < PARTITION_START) {
263 ret = TFR(read(0, jffs + len, PARTITION_START - len));
264 if (ret <= 0)
265 break;
266 len += ret;
267 }
268
269 /* Convert data from stdin */
270 partition = len = eccbyte = count = 0;
271 memset(ecc_payload, 0xff, ecc.style->oob_size);
272 jffs2_format(&ecc, ecc_payload);
273 while (count < ecc.style->romsize) {
274 buffer_fill(&ecc, buffer, &len, &partition, count, jffs);
275 buffer_digest(&ecc, buffer, regs);
276
277 ecc_payload[ecc.style->eccpos[eccbyte ++]] = regs[0];
278 ecc_payload[ecc.style->eccpos[eccbyte ++]] = regs[1];
279 ecc_payload[ecc.style->eccpos[eccbyte ++]] = regs[2];
280
281 TFR(write(1, buffer, ecc.style->eccbytes));
282 count += ecc.style->eccbytes;
283 len -= ecc.style->eccbytes;
284 memmove(buffer, buffer + ecc.style->eccbytes, len);
285
286 if (eccbyte >= ecc.style->eccsize) {
287 TFR(write(1, ecc_payload, ecc.style->oob_size));
288 eccbyte = 0;
289 memset(ecc_payload, 0xff, ecc.style->oob_size);
290 if (partition < 2)
291 jffs2_format(&ecc, ecc_payload);
292 }
293
294# ifdef VERBOSE
295 if (count * PBAR_LEN / ecc.style->romsize >
296 (count - ecc.style->eccbytes) *
297 PBAR_LEN / ecc.style->romsize)
298 fprintf(stderr, "#");
299# endif
300 }
301
302# ifdef VERBOSE
303 fprintf(stderr, "]\n");
304# endif
305 free(jffs);
306 return 0;
307}
308#else
309int main(int argc, char *argv[], char *envp[]) {
310 struct ecc_state_s ecc;
311 uint8_t buffer[0x1000];
312 int ret, len, count;
313
314 /* Check if we're called by "flash2raw.spitz" or similar */
315 len = strlen(argv[0]);
316 if (!strcasecmp(argv[0] + len - 5, "akita"))
317 ecc.style = &akita;
318 else if (!strcasecmp(argv[0] + len - 6, "borzoi"))
319 ecc.style = &borzoi;
320 else if (!strcasecmp(argv[0] + len - 7, "terrier"))
321 ecc.style = &terrier;
322 else
323 ecc.style = &spitz;
324
325# ifdef VERBOSE
326 fprintf(stderr, "[");
327# endif
328
329 /* Convert data from stdin */
330 count = 0;
331 while (count < ecc.style->romsize) {
332 len = 0;
333 while (len < ecc.style->page_size) {
334 ret = TFR(read(0, buffer + len,
335 ecc.style->page_size - len));
336 if (ret <= 0)
337 break;
338 len += ret;
339 }
340 if (len == 0)
341 break;
342 if (len < ecc.style->page_size) {
343 fprintf(stderr, "\nWarning: %i stray bytes\n", len);
344 }
345
346 TFR(write(1, buffer, ecc.style->page_size));
347
348 count += len;
349 len = 0;
350 while (len < ecc.style->oob_size) {
351 ret = TFR(read(0, buffer, ecc.style->oob_size - len));
352 if (ret <= 0)
353 break;
354 len += ret;
355 }
356
357# ifdef VERBOSE
358 if (count * PBAR_LEN / ecc.style->romsize >
359 (count - ecc.style->page_size) *
360 PBAR_LEN / ecc.style->romsize)
361 fprintf(stderr, "#");
362# endif
363 }
364
365# ifdef VERBOSE
366 fprintf(stderr, "]\n");
367# endif
368 return 0;
369}
370#endif
diff --git a/meta/recipes-devtools/qemu/qemu-helper/tunctl.c b/meta/recipes-devtools/qemu/qemu-helper/tunctl.c
new file mode 100644
index 0000000000..16e24a2add
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu-helper/tunctl.c
@@ -0,0 +1,156 @@
1/* Copyright 2002 Jeff Dike
2 * Licensed under the GPL
3 */
4
5#include <stdio.h>
6#include <stdlib.h>
7#include <string.h>
8#include <errno.h>
9#include <fcntl.h>
10#include <unistd.h>
11#include <pwd.h>
12#include <grp.h>
13#include <net/if.h>
14#include <sys/ioctl.h>
15#include <linux/if_tun.h>
16
17/* TUNSETGROUP appeared in 2.6.23 */
18#ifndef TUNSETGROUP
19#define TUNSETGROUP _IOW('T', 206, int)
20#endif
21
22static void Usage(char *name)
23{
24 fprintf(stderr, "Create: %s [-b] [-u owner] [-g group] [-t device-name] "
25 "[-f tun-clone-device]\n", name);
26 fprintf(stderr, "Delete: %s -d device-name [-f tun-clone-device]\n\n",
27 name);
28 fprintf(stderr, "The default tun clone device is /dev/net/tun - some systems"
29 " use\n/dev/misc/net/tun instead\n\n");
30 fprintf(stderr, "-b will result in brief output (just the device name)\n");
31 exit(1);
32}
33
34int main(int argc, char **argv)
35{
36 struct ifreq ifr;
37 struct passwd *pw;
38 struct group *gr;
39 uid_t owner = -1;
40 gid_t group = -1;
41 int tap_fd, opt, delete = 0, brief = 0;
42 char *tun = "", *file = "/dev/net/tun", *name = argv[0], *end;
43
44 while((opt = getopt(argc, argv, "bd:f:t:u:g:")) > 0){
45 switch(opt) {
46 case 'b':
47 brief = 1;
48 break;
49 case 'd':
50 delete = 1;
51 tun = optarg;
52 break;
53 case 'f':
54 file = optarg;
55 break;
56 case 'u':
57 pw = getpwnam(optarg);
58 if(pw != NULL){
59 owner = pw->pw_uid;
60 break;
61 }
62 owner = strtol(optarg, &end, 0);
63 if(*end != '\0'){
64 fprintf(stderr, "'%s' is neither a username nor a numeric uid.\n",
65 optarg);
66 Usage(name);
67 }
68 break;
69 case 'g':
70 gr = getgrnam(optarg);
71 if(gr != NULL){
72 group = gr->gr_gid;
73 break;
74 }
75 group = strtol(optarg, &end, 0);
76 if(*end != '\0'){
77 fprintf(stderr, "'%s' is neither a groupname nor a numeric group.\n",
78 optarg);
79 Usage(name);
80 }
81 break;
82
83 case 't':
84 tun = optarg;
85 break;
86 case 'h':
87 default:
88 Usage(name);
89 }
90 }
91
92 argv += optind;
93 argc -= optind;
94
95 if(argc > 0)
96 Usage(name);
97
98 if((tap_fd = open(file, O_RDWR)) < 0){
99 fprintf(stderr, "Failed to open '%s' : ", file);
100 perror("");
101 exit(1);
102 }
103
104 memset(&ifr, 0, sizeof(ifr));
105
106 ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
107 strncpy(ifr.ifr_name, tun, sizeof(ifr.ifr_name) - 1);
108 if(ioctl(tap_fd, TUNSETIFF, (void *) &ifr) < 0){
109 perror("TUNSETIFF");
110 exit(1);
111 }
112
113 if(delete){
114 if(ioctl(tap_fd, TUNSETPERSIST, 0) < 0){
115 perror("disabling TUNSETPERSIST");
116 exit(1);
117 }
118 printf("Set '%s' nonpersistent\n", ifr.ifr_name);
119 }
120 else {
121 /* emulate behaviour prior to TUNSETGROUP */
122 if(owner == -1 && group == -1) {
123 owner = geteuid();
124 }
125
126 if(owner != -1) {
127 if(ioctl(tap_fd, TUNSETOWNER, owner) < 0){
128 perror("TUNSETOWNER");
129 exit(1);
130 }
131 }
132 if(group != -1) {
133 if(ioctl(tap_fd, TUNSETGROUP, group) < 0){
134 perror("TUNSETGROUP");
135 exit(1);
136 }
137 }
138
139 if(ioctl(tap_fd, TUNSETPERSIST, 1) < 0){
140 perror("enabling TUNSETPERSIST");
141 exit(1);
142 }
143
144 if(brief)
145 printf("%s\n", ifr.ifr_name);
146 else {
147 printf("Set '%s' persistent and owned by", ifr.ifr_name);
148 if(owner != -1)
149 printf(" uid %d", owner);
150 if(group != -1)
151 printf(" gid %d", group);
152 printf("\n");
153 }
154 }
155 return(0);
156}
diff --git a/meta/recipes-devtools/qemu/qemu-targets.inc b/meta/recipes-devtools/qemu/qemu-targets.inc
new file mode 100644
index 0000000000..5c3565544e
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu-targets.inc
@@ -0,0 +1,22 @@
1# possible arch values are arm aarch64 mips mipsel mips64 mips64el ppc ppc64 ppc64abi32
2# ppcemb armeb alpha sparc32plus i386 x86_64 cris m68k microblaze sparc sparc32
3# sparc32plus
4
5def get_qemu_target_list(d):
6 import bb
7 archs = d.getVar('QEMU_TARGETS', True).split()
8 tos = d.getVar('HOST_OS', True)
9 softmmuonly = ""
10 for arch in ['mips64', 'mips64el', 'ppcemb']:
11 if arch in archs:
12 softmmuonly += arch + "-softmmu,"
13 archs.remove(arch)
14 linuxuseronly = ""
15 for arch in ['armeb', 'alpha', 'ppc64abi32', 'sparc32plus']:
16 if arch in archs:
17 linuxuseronly += arch + "-linux-user,"
18 archs.remove(arch)
19 if 'linux' not in tos:
20 return softmmuonly + ''.join([arch + "-softmmu" + "," for arch in archs]).rstrip(',')
21 return softmmuonly + linuxuseronly + ''.join([arch + "-linux-user" + "," + arch + "-softmmu" + "," for arch in archs]).rstrip(',')
22
diff --git a/meta/recipes-devtools/qemu/qemu.inc b/meta/recipes-devtools/qemu/qemu.inc
new file mode 100644
index 0000000000..c9a5d328f9
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu.inc
@@ -0,0 +1,124 @@
1SUMMARY = "Fast open source processor emulator"
2HOMEPAGE = "http://qemu.org"
3LICENSE = "GPLv2 & LGPLv2.1"
4DEPENDS = "glib-2.0 zlib pixman"
5RDEPENDS_${PN}_class-target += "bash python"
6
7require qemu-targets.inc
8inherit autotools-brokensep
9BBCLASSEXTEND = "native nativesdk"
10
11# QEMU_TARGETS is overridable variable
12QEMU_TARGETS ?= "arm aarch64 i386 mips mipsel mips64 mips64el ppc sh4 x86_64"
13
14SRC_URI = "\
15 file://powerpc_rom.bin \
16 file://larger_default_ram_size.patch \
17 file://disable-grabs.patch \
18 file://exclude-some-arm-EABI-obsolete-syscalls.patch \
19 file://wacom.patch \
20 "
21
22SRC_URI_append_class-native = "\
23 file://fix-libcap-header-issue-on-some-distro.patch \
24 "
25
26EXTRA_OECONF += "--target-list=${@get_qemu_target_list(d)} --disable-werror --disable-bluez --disable-libiscsi --with-system-pixman --extra-cflags='${CFLAGS}'"
27
28EXTRA_OECONF_class-nativesdk = "--target-list=${@get_qemu_target_list(d)} --disable-werror \
29 "
30export LIBTOOL="${HOST_SYS}-libtool"
31
32do_configure_prepend_class-native() {
33 # Append build host pkg-config paths for native target since the host may provide sdl
34 BHOST_PKGCONFIG_PATH=$(PATH=/usr/bin:/bin pkg-config --variable pc_path pkg-config || echo "")
35 if [ ! -z "$BHOST_PKGCONFIG_PATH" ]; then
36 export PKG_CONFIG_PATH=$PKG_CONFIG_PATH:$BHOST_PKGCONFIG_PATH
37 fi
38
39 # Undo the -lX11 added by linker-flags.patch, don't assume that host has libX11 installed
40 sed -i 's/-lX11//g' Makefile.target
41}
42
43do_configure_prepend_class-nativesdk() {
44 if [ "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'x11', '', d)}" = "" ] ; then
45 # Undo the -lX11 added by linker-flags.patch
46 sed -i 's/-lX11//g' Makefile.target
47 fi
48}
49
50KVMENABLE = "--enable-kvm"
51KVMENABLE_darwin = "--disable-kvm"
52KVMENABLE_mingw32 = "--disable-kvm"
53
54do_configure() {
55 # Handle distros such as CentOS 5 32-bit that do not have kvm support
56 KVMOPTS="--disable-kvm"
57 if [ "${PN}" != "qemu-native" -a "${PN}" != "nativesdk-qemu" ] \
58 || [ -f /usr/include/linux/kvm.h ] ; then
59 KVMOPTS="${KVMENABLE}"
60 fi
61
62 ${S}/configure --prefix=${prefix} --sysconfdir=${sysconfdir} --libexecdir=${libexecdir} --localstatedir=${localstatedir} --disable-strip ${EXTRA_OECONF} $KVMOPTS
63 test ! -e ${S}/target-i386/beginend_funcs.sh || chmod a+x ${S}/target-i386/beginend_funcs.sh
64}
65
66do_install () {
67 export STRIP="true"
68 autotools_do_install
69 install -d ${D}${datadir}/qemu
70 install -m 0755 ${WORKDIR}/powerpc_rom.bin ${D}${datadir}/qemu
71}
72
73# The following fragment will create a wrapper for qemu-mips user emulation
74# binary in order to work around a segmentation fault issue. Basically, by
75# default, the reserved virtual address space for 32-on-64 bit is set to 4GB.
76# This will trigger a MMU access fault in the virtual CPU. With this change,
77# the qemu-mips works fine.
78# IMPORTANT: This piece needs to be removed once the root cause is fixed!
79do_install_append() {
80 if [ -e "${D}/${bindir}/qemu-mips" ]; then
81 create_wrapper ${D}/${bindir}/qemu-mips \
82 QEMU_RESERVED_VA=0x0
83 fi
84}
85# END of qemu-mips workaround
86
87PACKAGECONFIG ??= "fdt sdl alsa"
88PACKAGECONFIG_class-native ??= "fdt alsa"
89PACKAGECONFIG_class-nativesdk ??= "fdt sdl"
90NATIVEDEPS = ""
91NATIVEDEPS_class-native = "${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'libxext-native', '',d)}"
92PACKAGECONFIG[sdl] = "--enable-sdl,--disable-sdl,libsdl ${NATIVEDEPS},"
93PACKAGECONFIG[virtfs] = "--enable-virtfs --enable-attr,--disable-virtfs,libcap attr,"
94PACKAGECONFIG[aio] = "--enable-linux-aio,--disable-linux-aio,libaio,"
95PACKAGECONFIG[xfs] = "--enable-xfsctl,--disable-xfsctl,xfsprogs,"
96PACKAGECONFIG[xen] = "--enable-xen, --disable-xen,,"
97PACKAGECONFIG[quorum] = "--enable-quorum, --disable-quorum, gnutls,"
98PACKAGECONFIG[vnc-tls] = "--enable-vnc --enable-vnc-tls,--disable-vnc-tls, gnutls,"
99PACKAGECONFIG[vnc-ws] = "--enable-vnc --enable-vnc-ws,--disable-vnc-ws, gnutls,"
100PACKAGECONFIG[vnc-sasl] = "--enable-vnc --enable-vnc-sasl,--disable-vnc-sasl,cyrus-sasl,"
101PACKAGECONFIG[vnc-jpeg] = "--enable-vnc --enable-vnc-jpeg,--disable-vnc-jpeg,jpeg,"
102PACKAGECONFIG[vnc-png] = "--enable-vnc --enable-vnc-png,--disable-vnc-png,libpng,"
103PACKAGECONFIG[libcurl] = "--enable-curl,--disable-curl,libcurl,"
104PACKAGECONFIG[nss] = "--enable-smartcard-nss,--disable-smartcard-nss,nss,"
105PACKAGECONFIG[uuid] = "--enable-uuid,--disable-uuid,util-linux,"
106PACKAGECONFIG[curses] = "--enable-curses,--disable-curses,ncurses,"
107PACKAGECONFIG[gtk+] = "--enable-gtk --enable-vte,--disable-gtk --disable-vte,gtk+ libvte,"
108PACKAGECONFIG[libcap-ng] = "--enable-cap-ng,--disable-cap-ng,libcap-ng,"
109PACKAGECONFIG[ssh2] = "--enable-libssh2,--disable-libssh2,libssh2,"
110PACKAGECONFIG[libusb] = "--enable-libusb,--disable-libusb,libusb1"
111PACKAGECONFIG[fdt] = "--enable-fdt,--disable-fdt,dtc"
112PACKAGECONFIG[alsa] = ",,alsa-lib"
113PACKAGECONFIG[glx] = "--enable-glx,--disable-glx,mesa"
114PACKAGECONFIG[lzo] = "--enable-lzo,--disable-lzo,lzo"
115PACKAGECONFIG[numa] = "--enable-numa,--disable-numa,numactl"
116
117EXTRA_OECONF += "${@bb.utils.contains('PACKAGECONFIG', 'alsa', '--audio-drv-list=oss,alsa', '', d)}"
118
119# Qemu target will not build in world build for ARM or Mips
120BROKEN_qemuarm = "1"
121BROKEN_qemumips64 = "1"
122BROKEN_qemumips = "1"
123
124INSANE_SKIP_${PN} = "arch"
diff --git a/meta/recipes-devtools/qemu/qemu/CVE-2014-7840.patch b/meta/recipes-devtools/qemu/qemu/CVE-2014-7840.patch
new file mode 100644
index 0000000000..4f992bae14
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/CVE-2014-7840.patch
@@ -0,0 +1,57 @@
1From 0be839a2701369f669532ea5884c15bead1c6e08 Mon Sep 17 00:00:00 2001
2From: "Michael S. Tsirkin" <mst@redhat.com>
3Date: Wed, 12 Nov 2014 11:44:39 +0200
4Subject: [PATCH] migration: fix parameter validation on ram load
5
6During migration, the values read from migration stream during ram load
7are not validated. Especially offset in host_from_stream_offset() and
8also the length of the writes in the callers of said function.
9
10To fix this, we need to make sure that the [offset, offset + length]
11range fits into one of the allocated memory regions.
12
13Validating addr < len should be sufficient since data seems to always be
14managed in TARGET_PAGE_SIZE chunks.
15
16Fixes: CVE-2014-7840
17
18Upstream-Status: Backport
19
20Note: follow-up patches add extra checks on each block->host access.
21
22Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
23Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
24Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
25Signed-off-by: Amit Shah <amit.shah@redhat.com>
26Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
27---
28 arch_init.c | 5 +++--
29 1 file changed, 3 insertions(+), 2 deletions(-)
30
31diff --git a/arch_init.c b/arch_init.c
32index 88a5ba0..593a990 100644
33--- a/arch_init.c
34+++ b/arch_init.c
35@@ -1006,7 +1006,7 @@ static inline void *host_from_stream_offset(QEMUFile *f,
36 uint8_t len;
37
38 if (flags & RAM_SAVE_FLAG_CONTINUE) {
39- if (!block) {
40+ if (!block || block->length <= offset) {
41 error_report("Ack, bad migration stream!");
42 return NULL;
43 }
44@@ -1019,8 +1019,9 @@ static inline void *host_from_stream_offset(QEMUFile *f,
45 id[len] = 0;
46
47 QTAILQ_FOREACH(block, &ram_list.blocks, next) {
48- if (!strncmp(id, block->idstr, sizeof(id)))
49+ if (!strncmp(id, block->idstr, sizeof(id)) && block->length > offset) {
50 return memory_region_get_ram_ptr(block->mr) + offset;
51+ }
52 }
53
54 error_report("Can't find block %s!", id);
55--
561.9.1
57
diff --git a/meta/recipes-devtools/qemu/qemu/configure-fix-Darwin-target-detection.patch b/meta/recipes-devtools/qemu/qemu/configure-fix-Darwin-target-detection.patch
new file mode 100644
index 0000000000..59cdc1c304
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/configure-fix-Darwin-target-detection.patch
@@ -0,0 +1,32 @@
1Upstream-Status: Pending
2Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
3
4From 9ac096d8eccf2d56ece646320c282c8369f8337c Mon Sep 17 00:00:00 2001
5From: Cristian Iorga <cristian.iorga@intel.com>
6Date: Tue, 29 Jul 2014 18:35:59 +0300
7Subject: [PATCH] configure: fix Darwin target detection
8
9fix Darwin target detection for qemu
10cross-compilation.
11
12Signed-off-by: Cristian Iorga <cristian.iorga@intel.com>
13---
14 configure | 2 ++
15 1 file changed, 2 insertions(+)
16
17diff --git a/configure b/configure
18index 283c71c..1c66a11 100755
19--- a/configure
20+++ b/configure
21@@ -444,6 +444,8 @@ elif check_define __sun__ ; then
22 targetos='SunOS'
23 elif check_define __HAIKU__ ; then
24 targetos='Haiku'
25+elif check_define __APPLE__ ; then
26+ targetos='Darwin'
27 else
28 targetos=`uname -s`
29 fi
30--
311.9.1
32
diff --git a/meta/recipes-devtools/qemu/qemu/disable-grabs.patch b/meta/recipes-devtools/qemu/qemu/disable-grabs.patch
new file mode 100644
index 0000000000..41726b1c87
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/disable-grabs.patch
@@ -0,0 +1,72 @@
1When the pointer enters the Qemu window it calls SDL_WM_GrabInput, which calls
2XGrabPointer in a busyloop until it returns GrabSuccess. However if there's already
3a pointer grab (screen is locked, a menu is open) then qemu will hang until the
4grab can be taken. In the specific case of a headless X server on an autobuilder, once
5the screensaver has kicked in any qemu instance that appears underneath the
6pointer will hang.
7
8I'm not entirely sure why pointer grabs are required (the documentation
9explicitly says it doesn't do grabs when using a tablet, which we are) so wrap
10them in a conditional that can be set by the autobuilder environment, preserving
11the current grabbing behaviour for everyone else.
12
13Upstream-Status: Pending
14Signed-off-by: Ross Burton <ross.burton@intel.com>
15
16From 4b1988ecb01a178269ec0513a75f2ec620c7ef6a Mon Sep 17 00:00:00 2001
17From: Ross Burton <ross.burton@intel.com>
18Date: Wed, 18 Sep 2013 14:04:54 +0100
19Subject: [PATCH] sdl.c: allow user to disable pointer grabs
20
21Signed-off-by: Ross Burton <ross.burton@intel.com>
22Signed-off-by: Eric Bénard <eric@eukrea.com>
23---
24 ui/sdl.c | 12 ++++++++++--
25 1 file changed, 10 insertions(+), 2 deletions(-)
26
27diff --git a/ui/sdl.c b/ui/sdl.c
28index 39a42d6..9b8abe5 100644
29--- a/ui/sdl.c
30+++ b/ui/sdl.c
31@@ -59,6 +59,10 @@ static SDL_Cursor *guest_sprite = NULL;
32 static SDL_PixelFormat host_format;
33 static int scaling_active = 0;
34 static Notifier mouse_mode_notifier;
35+#ifndef True
36+#define True 1
37+#endif
38+static doing_grabs = True;
39
40 static void sdl_update(DisplayChangeListener *dcl,
41 int x, int y, int w, int h)
42@@ -384,14 +388,16 @@ static void sdl_grab_start(void)
43 SDL_WarpMouse(guest_x, guest_y);
44 } else
45 sdl_hide_cursor();
46- SDL_WM_GrabInput(SDL_GRAB_ON);
47+ if (doing_grabs)
48+ SDL_WM_GrabInput(SDL_GRAB_ON);
49 gui_grab = 1;
50 sdl_update_caption();
51 }
52
53 static void sdl_grab_end(void)
54 {
55- SDL_WM_GrabInput(SDL_GRAB_OFF);
56+ if (doing_grabs)
57+ SDL_WM_GrabInput(SDL_GRAB_OFF);
58 gui_grab = 0;
59 sdl_show_cursor();
60 sdl_update_caption();
61@@ -909,6 +915,8 @@ void sdl_display_init(DisplayState *ds, int full_screen, int no_frame)
62 * This requires SDL >= 1.2.14. */
63 setenv("SDL_DISABLE_LOCK_KEYS", "1", 1);
64
65+ doing_grabs = (getenv("QEMU_DONT_GRAB") == NULL);
66+
67 flags = SDL_INIT_VIDEO | SDL_INIT_NOPARACHUTE;
68 if (SDL_Init (flags)) {
69 fprintf(stderr, "Could not initialize SDL(%s) - exiting\n",
70--
711.8.3.1
72
diff --git a/meta/recipes-devtools/qemu/qemu/fix-libcap-header-issue-on-some-distro.patch b/meta/recipes-devtools/qemu/qemu/fix-libcap-header-issue-on-some-distro.patch
new file mode 100644
index 0000000000..13a6ea23b1
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/fix-libcap-header-issue-on-some-distro.patch
@@ -0,0 +1,84 @@
1fix libcap header issue on some distro
2
31, When build qemu-native on SLED 11.2, there is an error:
4...
5| In file included from /usr/include/bits/sigcontext.h:28,
6| from /usr/include/signal.h:339,
7| from /buildarea2/tmp/work/i686-linux/qemu-native/1.4.0-r0/
8qemu-1.4.0/include/qemu-common.h:42,
9| from fsdev/virtfs-proxy-helper.c:23:
10| /usr/include/asm/sigcontext.h:28: error: expected specifier-
11qualifier-list before '__u64'
12| /usr/include/asm/sigcontext.h:191: error: expected specifier-
13qualifier-list before '__u64'
14...
15
162, The virtfs-proxy-helper.c includes <sys/capability.h> and
17qemu-common.h in sequence. The header include map is:
18(`-->' presents `include')
19...
20"virtfs-proxy-helper.c" --> <sys/capability.h>
21...
22"virtfs-proxy-helper.c" --> "qemu-common.h" --> <signal.h> -->
23<bits/sigcontext.h> --> <asm/sigcontext.h> --> <linux/types.h> -->
24<asm/types.h> --> <asm-generic/types.h> --> <asm-generic/int-ll64.h>
25...
26
273, The bug is found on SLED 11.2 x86. In libcap header file
28/usr/include/sys/capability.h, it does evil stuff like this:
29...
30 25 /*
31 26 * Make sure we can be included from userland by preventing
32 27 * capability.h from including other kernel headers
33 28 */
34 29 #define _LINUX_TYPES_H
35 30 #define _LINUX_FS_H
36 31 #define __LINUX_COMPILER_H
37 32 #define __user
38 33
39 34 typedef unsigned int __u32;
40 35 typedef __u32 __le32;
41...
42This completely prevents including /usr/include/linux/types.h.
43The above `<asm/sigcontext.h> --> <linux/types.h>' is prevented,
44and '__u64' is defined in <asm-generic/int-ll64.h>.
45
464, Modify virtfs-proxy-helper.c to include <sys/capability.h>
47last to workaround the issue.
48
49http://www.linuxtv.org/pipermail/vdr/2009-August/021194.html
50http://patchwork.linuxtv.org/patch/12748/
51
52Upstream-Status: Pending
53Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
54---
55 fsdev/virtfs-proxy-helper.c | 7 +++++--
56 1 file changed, 5 insertions(+), 2 deletions(-)
57
58diff --git a/fsdev/virtfs-proxy-helper.c b/fsdev/virtfs-proxy-helper.c
59--- a/fsdev/virtfs-proxy-helper.c
60+++ b/fsdev/virtfs-proxy-helper.c
61@@ -12,7 +12,6 @@
62 #include <sys/resource.h>
63 #include <getopt.h>
64 #include <syslog.h>
65-#include <sys/capability.h>
66 #include <sys/fsuid.h>
67 #include <sys/vfs.h>
68 #include <sys/ioctl.h>
69@@ -26,7 +25,11 @@
70 #include "virtio-9p-marshal.h"
71 #include "hw/9pfs/virtio-9p-proxy.h"
72 #include "fsdev/virtio-9p-marshal.h"
73-
74+/*
75+ * Include this one last due to some versions of it being buggy:
76+ * http://www.linuxtv.org/pipermail/vdr/2009-August/021194.html
77+ */
78+#include <sys/capability.h>
79 #define PROGNAME "virtfs-proxy-helper"
80
81 #ifndef XFS_SUPER_MAGIC
82--
831.7.10.4
84
diff --git a/meta/recipes-devtools/qemu/qemu/larger_default_ram_size.patch b/meta/recipes-devtools/qemu/qemu/larger_default_ram_size.patch
new file mode 100644
index 0000000000..711c36071d
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/larger_default_ram_size.patch
@@ -0,0 +1,22 @@
1This patch is taken from debian. 128M is too less sometimes if distro
2with lot of packages is booted so this patch raises the default to 384M
3
4It has not been applied to upstream qemu
5
6Khem Raj <raj.khem@gmail.com>
7
8Upstream-Status: Pending
9
10Index: qemu-0.14.0/vl.c
11===================================================================
12--- qemu-0.14.0.orig/vl.c
13+++ qemu-0.14.0/vl.c
14@@ -168,7 +168,7 @@ int main(int argc, char **argv)
15 //#define DEBUG_NET
16 //#define DEBUG_SLIRP
17
18-#define DEFAULT_RAM_SIZE 128
19+#define DEFAULT_RAM_SIZE 384
20
21 #define MAX_VIRTIO_CONSOLES 1
22
diff --git a/meta/recipes-devtools/qemu/qemu/powerpc_rom.bin b/meta/recipes-devtools/qemu/qemu/powerpc_rom.bin
new file mode 100644
index 0000000000..c4044296c5
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/powerpc_rom.bin
Binary files differ
diff --git a/meta/recipes-devtools/qemu/qemu/qemu-CVE-2015-3456.patch b/meta/recipes-devtools/qemu/qemu/qemu-CVE-2015-3456.patch
new file mode 100644
index 0000000000..f05441fce6
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/qemu-CVE-2015-3456.patch
@@ -0,0 +1,92 @@
1qemu: CVE-2015-3456
2
3the patch comes from:
4https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3456
5http://git.qemu.org/?p=qemu.git;a=commit;h=e907746266721f305d67bc0718795fedee2e824c
6
7fdc: force the fifo access to be in bounds of the allocated buffer
8
9During processing of certain commands such as FD_CMD_READ_ID and
10FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory access could
11get out of bounds leading to memory corruption with values coming
12from the guest.
13
14Fix this by making sure that the index is always bounded by the
15allocated memory.
16
17This is CVE-2015-3456.
18
19Signed-off-by: Petr Matousek <pmatouse@redhat.com>
20Reviewed-by: John Snow <jsnow@redhat.com>
21Signed-off-by: John Snow <jsnow@redhat.com>
22Signed-off-by: Li Wang <li.wang@windriver.com>
23
24Upstream-Status: Backport
25
26Signed-off-by: Kai Kang <kai.kang@windriver.com>
27---
28 hw/block/fdc.c | 17 +++++++++++------
29 1 file changed, 11 insertions(+), 6 deletions(-)
30
31diff --git a/hw/block/fdc.c b/hw/block/fdc.c
32index 490d127..045459e 100644
33--- a/hw/block/fdc.c
34+++ b/hw/block/fdc.c
35@@ -1436,7 +1436,7 @@ static uint32_t fdctrl_read_data(FDCtrl *fdctrl)
36 {
37 FDrive *cur_drv;
38 uint32_t retval = 0;
39- int pos;
40+ uint32_t pos;
41
42 cur_drv = get_cur_drv(fdctrl);
43 fdctrl->dsr &= ~FD_DSR_PWRDOWN;
44@@ -1445,8 +1445,8 @@ static uint32_t fdctrl_read_data(FDCtrl *fdctrl)
45 return 0;
46 }
47 pos = fdctrl->data_pos;
48+ pos %= FD_SECTOR_LEN;
49 if (fdctrl->msr & FD_MSR_NONDMA) {
50- pos %= FD_SECTOR_LEN;
51 if (pos == 0) {
52 if (fdctrl->data_pos != 0)
53 if (!fdctrl_seek_to_next_sect(fdctrl, cur_drv)) {
54@@ -1790,10 +1790,13 @@ static void fdctrl_handle_option(FDCtrl *fdctrl, int direction)
55 static void fdctrl_handle_drive_specification_command(FDCtrl *fdctrl, int direction)
56 {
57 FDrive *cur_drv = get_cur_drv(fdctrl);
58+ uint32_t pos;
59
60- if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x80) {
61+ pos = fdctrl->data_pos - 1;
62+ pos %= FD_SECTOR_LEN;
63+ if (fdctrl->fifo[pos] & 0x80) {
64 /* Command parameters done */
65- if (fdctrl->fifo[fdctrl->data_pos - 1] & 0x40) {
66+ if (fdctrl->fifo[pos] & 0x40) {
67 fdctrl->fifo[0] = fdctrl->fifo[1];
68 fdctrl->fifo[2] = 0;
69 fdctrl->fifo[3] = 0;
70@@ -1893,7 +1896,7 @@ static uint8_t command_to_handler[256];
71 static void fdctrl_write_data(FDCtrl *fdctrl, uint32_t value)
72 {
73 FDrive *cur_drv;
74- int pos;
75+ uint32_t pos;
76
77 /* Reset mode */
78 if (!(fdctrl->dor & FD_DOR_nRESET)) {
79@@ -1941,7 +1944,9 @@ static void fdctrl_write_data(FDCtrl *fdctrl, uint32_t value)
80 }
81
82 FLOPPY_DPRINTF("%s: %02x\n", __func__, value);
83- fdctrl->fifo[fdctrl->data_pos++] = value;
84+ pos = fdctrl->data_pos++;
85+ pos %= FD_SECTOR_LEN;
86+ fdctrl->fifo[pos] = value;
87 if (fdctrl->data_pos == fdctrl->data_len) {
88 /* We now have all parameters
89 * and will be able to treat the command
90--
911.7.9.5
92
diff --git a/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch b/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch
new file mode 100644
index 0000000000..a7ecf31c01
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/slirp-CVE-2014-3640.patch
@@ -0,0 +1,48 @@
1From 9a72433843d912a45046959b1953861211d1838d Mon Sep 17 00:00:00 2001
2From: Petr Matousek <pmatouse@redhat.com>
3Date: Thu, 18 Sep 2014 08:35:37 +0200
4Subject: [PATCH] slirp: udp: fix NULL pointer dereference because of
5 uninitialized socket
6
7When guest sends udp packet with source port and source addr 0,
8uninitialized socket is picked up when looking for matching and already
9created udp sockets, and later passed to sosendto() where NULL pointer
10dereference is hit during so->slirp->vnetwork_mask.s_addr access.
11
12Fix this by checking that the socket is not just a socket stub.
13
14This is CVE-2014-3640.
15
16Upstream-Status: Backport
17
18Signed-off-by: Petr Matousek <pmatouse@redhat.com>
19Reported-by: Xavier Mehrenberger <xavier.mehrenberger@airbus.com>
20Reported-by: Stephane Duverger <stephane.duverger@eads.net>
21Reviewed-by: Jan Kiszka <jan.kiszka@siemens.com>
22Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
23Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
24Message-id: 20140918063537.GX9321@dhcp-25-225.brq.redhat.com
25Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
26(cherry picked from commit 01f7cecf0037997cb0e58ec0d56bf9b5a6f7cb2a)
27Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
28Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
29---
30 slirp/udp.c | 2 +-
31 1 file changed, 1 insertion(+), 1 deletion(-)
32
33diff --git a/slirp/udp.c b/slirp/udp.c
34index 8cc6cb6..f77e00f 100644
35--- a/slirp/udp.c
36+++ b/slirp/udp.c
37@@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen)
38 * Locate pcb for datagram.
39 */
40 so = slirp->udp_last_so;
41- if (so->so_lport != uh->uh_sport ||
42+ if (so == &slirp->udb || so->so_lport != uh->uh_sport ||
43 so->so_laddr.s_addr != ip->ip_src.s_addr) {
44 struct socket *tmp;
45
46--
471.9.1
48
diff --git a/meta/recipes-devtools/qemu/qemu/vnc-CVE-2014-7815.patch b/meta/recipes-devtools/qemu/qemu/vnc-CVE-2014-7815.patch
new file mode 100644
index 0000000000..10a6dacbe5
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/vnc-CVE-2014-7815.patch
@@ -0,0 +1,53 @@
1From b2f1d90530301d7915dddc8a750063757675b21a Mon Sep 17 00:00:00 2001
2From: Petr Matousek <pmatouse@redhat.com>
3Date: Mon, 27 Oct 2014 12:41:44 +0100
4Subject: [PATCH] vnc: sanitize bits_per_pixel from the client
5
6bits_per_pixel that are less than 8 could result in accessing
7non-initialized buffers later in the code due to the expectation
8that bytes_per_pixel value that is used to initialize these buffers is
9never zero.
10
11To fix this check that bits_per_pixel from the client is one of the
12values that the rfb protocol specification allows.
13
14This is CVE-2014-7815.
15
16Upstream-Status: Backport
17
18Signed-off-by: Petr Matousek <pmatouse@redhat.com>
19
20[ kraxel: apply codestyle fix ]
21
22Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
23(cherry picked from commit e6908bfe8e07f2b452e78e677da1b45b1c0f6829)
24Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
25Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com>
26---
27 ui/vnc.c | 10 ++++++++++
28 1 file changed, 10 insertions(+)
29
30diff --git a/ui/vnc.c b/ui/vnc.c
31index f8d9b7d..87e34ae 100644
32--- a/ui/vnc.c
33+++ b/ui/vnc.c
34@@ -2026,6 +2026,16 @@ static void set_pixel_format(VncState *vs,
35 return;
36 }
37
38+ switch (bits_per_pixel) {
39+ case 8:
40+ case 16:
41+ case 32:
42+ break;
43+ default:
44+ vnc_client_error(vs);
45+ return;
46+ }
47+
48 vs->client_pf.rmax = red_max;
49 vs->client_pf.rbits = hweight_long(red_max);
50 vs->client_pf.rshift = red_shift;
51--
521.9.1
53
diff --git a/meta/recipes-devtools/qemu/qemu/wacom.patch b/meta/recipes-devtools/qemu/qemu/wacom.patch
new file mode 100644
index 0000000000..fd1b4a6963
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu/wacom.patch
@@ -0,0 +1,130 @@
1The USB wacom device is missing a HID descriptor which causes it
2to fail to operate with recent kernels (e.g. 3.17).
3
4This patch adds a HID desriptor to the device, based upon one from
5real wcom device.
6
7Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
8
9Upstream-Status: Submitted
102014/11/27
11
12Index: qemu-2.1.0/hw/usb/dev-wacom.c
13===================================================================
14--- qemu-2.1.0.orig/hw/usb/dev-wacom.c 2014-08-01 15:12:17.000000000 +0100
15+++ qemu-2.1.0/hw/usb/dev-wacom.c 2014-10-12 12:13:30.540306042 +0100
16@@ -68,6 +68,89 @@
17 [STR_SERIALNUMBER] = "1",
18 };
19
20+static const uint8_t qemu_tablet_hid_report_descriptor[] = {
21+ 0x05, 0x01, /* Usage Page (Generic Desktop) */
22+ 0x09, 0x02, /* Usage (Mouse) */
23+ 0xa1, 0x01, /* Collection (Application) */
24+ 0x85, 0x01, /* Report ID (1) */
25+ 0x09, 0x01, /* Usage (Pointer) */
26+ 0xa1, 0x00, /* Collection (Physical) */
27+ 0x05, 0x09, /* Usage Page (Button) */
28+ 0x19, 0x01, /* Usage Minimum (1) */
29+ 0x29, 0x05, /* Usage Maximum (5) */
30+ 0x15, 0x00, /* Logical Minimum (0) */
31+ 0x25, 0x01, /* Logical Maximum (1) */
32+ 0x95, 0x05, /* Report Count (5) */
33+ 0x75, 0x01, /* Report Size (1) */
34+ 0x81, 0x02, /* Input (Data, Variable, Absolute) */
35+ 0x95, 0x01, /* Report Count (1) */
36+ 0x75, 0x03, /* Report Size (3) */
37+ 0x81, 0x01, /* Input (Constant) */
38+ 0x05, 0x01, /* Usage Page (Generic Desktop) */
39+ 0x09, 0x30, /* Usage (X) */
40+ 0x09, 0x31, /* Usage (Y) */
41+ 0x15, 0x81, /* Logical Minimum (-127) */
42+ 0x25, 0x7f, /* Logical Maximum (127) */
43+ 0x75, 0x08, /* Report Size (8) */
44+ 0x95, 0x02, /* Report Count (2) */
45+ 0x81, 0x06, /* Input (Data, Variable, Relative) */
46+ 0xc0, /* End Collection */
47+ 0xc0, /* End Collection */
48+ 0x05, 0x0d, /* Usage Page (Digitizer) */
49+ 0x09, 0x01, /* Usage (Digitizer) */
50+ 0xa1, 0x01, /* Collection (Application) */
51+ 0x85, 0x02, /* Report ID (2) */
52+ 0xa1, 0x00, /* Collection (Physical) */
53+ 0x06, 0x00, 0xff, /* Usage Page (Vendor 0xff00) */
54+ 0x09, 0x01, /* Usage (Digitizer) */
55+ 0x15, 0x00, /* Logical Minimum (0) */
56+ 0x26, 0xff, 0x00, /* Logical Maximum (255) */
57+ 0x75, 0x08, /* Report Size (8) */
58+ 0x95, 0x08, /* Report Count (8) */
59+ 0x81, 0x02, /* Input (Data, Variable, Absolute) */
60+ 0xc0, /* End Collection */
61+ 0x09, 0x01, /* Usage (Digitizer) */
62+ 0x85, 0x02, /* Report ID (2) */
63+ 0x95, 0x01, /* Report Count (1) */
64+ 0xb1, 0x02, /* FEATURE (2) */
65+ 0xc0, /* End Collection */
66+ 0x06, 0x00, 0xff, /* Usage Page (Vendor 0xff00) */
67+ 0x09, 0x01, /* Usage (Digitizer) */
68+ 0xa1, 0x01, /* Collection (Application) */
69+ 0x85, 0x02, /* Report ID (2) */
70+ 0x05, 0x0d, /* Usage Page (Digitizer) */
71+ 0x09, 0x22, /* Usage (Finger) */
72+ 0xa1, 0x00, /* Collection (Physical) */
73+ 0x06, 0x00, 0xff, /* Usage Page (Vendor 0xff00) */
74+ 0x09, 0x01, /* Usage (Digitizer) */
75+ 0x15, 0x00, /* Logical Minimum (0) */
76+ 0x26, 0xff, 0x00, /* Logical Maximum */
77+ 0x75, 0x08, /* Report Size (8) */
78+ 0x95, 0x02, /* Report Count (2) */
79+ 0x81, 0x02, /* Input (Data, Variable, Absolute) */
80+ 0x05, 0x01, /* Usage Page (Generic Desktop) */
81+ 0x09, 0x30, /* Usage (X) */
82+ 0x35, 0x00, /* Physical Minimum */
83+ 0x46, 0xe0, 0x2e, /* Physical Maximum */
84+ 0x26, 0xe0, 0x01, /* Logical Maximum */
85+ 0x75, 0x10, /* Report Size (16) */
86+ 0x95, 0x01, /* Report Count (1) */
87+ 0x81, 0x02, /* Input (Data, Variable, Absolute) */
88+ 0x09, 0x31, /* Usage (Y) */
89+ 0x46, 0x40, 0x1f, /* Physical Maximum */
90+ 0x26, 0x40, 0x01, /* Logical Maximum */
91+ 0x81, 0x02, /* Input (Data, Variable, Absolute) */
92+ 0x06, 0x00, 0xff, /* Usage Page (Vendor 0xff00) */
93+ 0x09, 0x01, /* Usage (Digitizer) */
94+ 0x26, 0xff, 0x00, /* Logical Maximum */
95+ 0x75, 0x08, /* Report Size (8) */
96+ 0x95, 0x0d, /* Report Count (13) */
97+ 0x81, 0x02, /* Input (Data, Variable, Absolute) */
98+ 0xc0, /* End Collection */
99+ 0xc0, /* End Collection */
100+};
101+
102+
103 static const USBDescIface desc_iface_wacom = {
104 .bInterfaceNumber = 0,
105 .bNumEndpoints = 1,
106@@ -85,7 +168,7 @@
107 0x00, /* u8 country_code */
108 0x01, /* u8 num_descriptors */
109 0x22, /* u8 type: Report */
110- 0x6e, 0, /* u16 len */
111+ sizeof(qemu_tablet_hid_report_descriptor), 0, /* u16 len */
112 },
113 },
114 },
115@@ -265,6 +350,15 @@
116 }
117
118 switch (request) {
119+ case InterfaceRequest | USB_REQ_GET_DESCRIPTOR:
120+ switch (value >> 8) {
121+ case 0x22:
122+ memcpy(data, qemu_tablet_hid_report_descriptor,
123+ sizeof(qemu_tablet_hid_report_descriptor));
124+ p->actual_length = sizeof(qemu_tablet_hid_report_descriptor);
125+ break;
126+ }
127+ break;
128 case WACOM_SET_REPORT:
129 if (s->mouse_grabbed) {
130 qemu_remove_mouse_event_handler(s->eh_entry);
diff --git a/meta/recipes-devtools/qemu/qemu_2.1.0.bb b/meta/recipes-devtools/qemu/qemu_2.1.0.bb
new file mode 100644
index 0000000000..92a89d699c
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu_2.1.0.bb
@@ -0,0 +1,32 @@
1require qemu.inc
2
3LIC_FILES_CHKSUM = "file://COPYING;md5=441c28d2cf86e15a37fa47e15a72fbac \
4 file://COPYING.LIB;endline=24;md5=c04def7ae38850e7d3ef548588159913"
5
6SRC_URI += "file://configure-fix-Darwin-target-detection.patch \
7 file://qemu-enlarge-env-entry-size.patch \
8 file://Qemu-Arm-versatilepb-Add-memory-size-checking.patch \
9 file://0001-Back-porting-security-fix-CVE-2014-5388.patch \
10 file://qemu-CVE-2015-3456.patch \
11 file://CVE-2014-7840.patch \
12 file://vnc-CVE-2014-7815.patch \
13 file://slirp-CVE-2014-3640.patch \
14 "
15SRC_URI_prepend = "http://wiki.qemu-project.org/download/${BP}.tar.bz2"
16SRC_URI[md5sum] = "6726977292b448cbc7f89998fac6983b"
17SRC_URI[sha256sum] = "397e23184f4bf613589a8fe0c6542461dc2afdf17ed337e97e6fd2f31e8f8802"
18
19COMPATIBLE_HOST_class-target_mips64 = "null"
20
21do_sanitize_sources() {
22 # These .git files point to a nonexistent path "../.git/modules" and will confuse git
23 # if it tries to recurse into those directories.
24 rm -f ${S}/dtc/.git ${S}/pixman/.git
25}
26
27addtask sanitize_sources after do_unpack before do_patch
28
29do_install_append() {
30 # Prevent QA warnings about installed ${localstatedir}/run
31 if [ -d ${D}${localstatedir}/run ]; then rmdir ${D}${localstatedir}/run; fi
32}
diff --git a/meta/recipes-devtools/qemu/qemu_git.bb b/meta/recipes-devtools/qemu/qemu_git.bb
new file mode 100644
index 0000000000..a30932a8ba
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemu_git.bb
@@ -0,0 +1,15 @@
1require qemu.inc
2
3SRCREV = "04024dea2674861fcf13582a77b58130c67fccd8"
4
5LIC_FILES_CHKSUM = "file://COPYING;md5=441c28d2cf86e15a37fa47e15a72fbac \
6 file://COPYING.LIB;endline=24;md5=c04def7ae38850e7d3ef548588159913"
7
8PV = "1.3.0+git${SRCPV}"
9
10SRC_URI_prepend = "git://git.qemu.org/qemu.git"
11S = "${WORKDIR}/git"
12
13DEFAULT_PREFERENCE = "-1"
14
15COMPATIBLE_HOST_class-target_mips64 = "null"
diff --git a/meta/recipes-devtools/qemu/qemuwrapper-cross_1.0.bb b/meta/recipes-devtools/qemu/qemuwrapper-cross_1.0.bb
new file mode 100644
index 0000000000..d2981b5575
--- /dev/null
+++ b/meta/recipes-devtools/qemu/qemuwrapper-cross_1.0.bb
@@ -0,0 +1,48 @@
1SUMMARY = "QEMU wrapper script"
2LICENSE = "MIT"
3LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
4
5inherit qemu
6
7do_install () {
8 install -d ${D}${bindir_crossscripts}/
9
10 echo "#!/bin/sh" > ${D}${bindir_crossscripts}/qemuwrapper
11 qemu_binary=${@qemu_target_binary(d)}
12 qemu_options='${@d.getVar("QEMU_OPTIONS_%s" % d.getVar('PACKAGE_ARCH', True), True) or d.getVar('QEMU_OPTIONS', True) or ""}'
13 echo "$qemu_binary $qemu_options \"\$@\"" >> ${D}${bindir_crossscripts}/qemuwrapper
14 fallback_qemu_bin=
15 case $qemu_binary in
16 "qemu-i386")
17 fallback_qemu_bin=qemu-x86_64
18 ;;
19 "qemu-x86_64")
20 fallback_qemu_bin=qemu-i386
21 ;;
22 *)
23 ;;
24 esac
25
26 if [ -n "$fallback_qemu_bin" ]; then
27
28 cat >> ${D}${bindir_crossscripts}/qemuwrapper << EOF
29rc=\$?
30if [ \$rc = 255 ]; then
31 $fallback_qemu_bin "\$@"
32 rc=\$?
33fi
34exit \$rc
35EOF
36
37 fi
38
39 chmod +x ${D}${bindir_crossscripts}/qemuwrapper
40}
41
42SYSROOT_PREPROCESS_FUNCS += "qemuwrapper_sysroot_preprocess"
43
44qemuwrapper_sysroot_preprocess () {
45 sysroot_stage_dir ${D}${bindir_crossscripts} ${SYSROOT_DESTDIR}${bindir_crossscripts}
46}
47
48INHIBIT_DEFAULT_DEPS = "1"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2026-04-22 18:08:24 +0000